A little iptables help

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



> Well, James, you are missing quite a lot here.  First of all, default 
> policy is
> set to ACCEPT, so everything goes through as if there were no firewall 
> rules at
> all.  Secondly, the examples people sent you implied you already had 
> some other
> firewall rules needed for them to work (most of them don't work on their own).
> 
> I'll attach sample /etc/sysconfig/iptables file with some comments you can use
> to play with.  It something I just typed for you, so might contain a type or
> two.  It's good starting point for building your own firewall rules.
> 
> The configuration style is total overkill for your simple problem, however if
> your configuration becomes complex with hundreds or thousands of rules, it'll
> pay off to do it this way from the beggining.
> 
> You might want to deinstall system-config-securitylevel and
> system-config-securitylevel-tui since they will blindly rewrite this 
> file.  You
> might also want to remove any other GUI tool for managing firewall 
> rules, since
> it will either overwrite this file, or it will use its own scripts to replace
> the rules with whatever that GUI tool thinks configuration should look 
> like. Also, if you use "/etc/init.d/iptables save" (as some folks 
> suggested), it will
> also overwrite this file with whatever are currently loaded rules 
> (you'll loose
> all those nice comments I put in for you, and nice looking ordering of them
> too).  To load the file, you might do "/etc/init.d/iptables start".  Once the
> rules are up and running, and you change something in the file, don't use
> iptables script to reload new version.  Use "iptables-restore
> /etc/sysconfig/iptables".  Or your current sessions might hung ;-)
> 
> OK, there's the file in attachment.
> 

Aleksandar,

Wow, this is excellent. I read through it all and commented out the 8000
stuff for the moment. I totally agree with doing it right from the
start. 

That being said it loaded fine. I can still ssh and hit http. The only
problem is that the VNC forward stuff still doesn't work. Here's what it
looks like applied.

#iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            state
RELATED
SSH_INP    tcp  --  anywhere             anywhere            tcp
spts:1024:65535 dpt:ssh flags:SYN,RST,ACK/SYN state NEW
HTTP_INP   tcp  --  anywhere             anywhere            tcp
spts:1024:65535 dpt:http flags:SYN,RST,ACK/SYN state NEW
LOG_INP    all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            state
RELATED
VNC_FWD    tcp  --  anywhere             anywhere            tcp
spts:1024:65535 dpt:5900 flags:SYN,RST,ACK/SYN state NEW
LOG_FWD    all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            state
RELATED
LOG_OUT    all  --  anywhere             anywhere

Chain HTTP_INP (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain LOG_FWD (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            LOG level
warning prefix `FORWARD '
RETURN     all  --  anywhere             anywhere

Chain LOG_INP (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            LOG level
warning prefix `INPUT '
RETURN     all  --  anywhere             anywhere

Chain LOG_OUT (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            LOG level
warning prefix `OUTPUT '
RETURN     all  --  anywhere             anywhere

Chain SSH_INP (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain VNC_FWD (1 references)
target     prot opt source               destination
ACCEPT     all  --  192.168.192.24       10.10.60.4
RETURN     all  --  anywhere             anywhere

If I do an nmap scan all it returns is port 22 and port 80. Since it's
port forwarded, should port 5900 show up as well? I'm doing the scan
from 192.168.192.24. 

I don't really understand the logging part. Is there a way I can turn on
some logging to see the VNC requests coming in and see what it's doing
with them?

Thanks for everything!
James


[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux